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CLAIMS 

What is claimed is: 

1. A method of determining a risk for fraud for an order, 
5 the method comprising: 

receiving an order from a customers- 
evaluating an order based upon indicators of possible 

high risk activities; 

if the order is not classified as a high risk order, 
10 then evaluating the order based upon indicators of possible 

medium risk activities; and 

if the order is not a medium risk activity, then 

classifying the order as a low risk order. 

15 2. The method of claim 1, wherein a high risk order is 
evaluated with more time than a medium risk order. 

3. The method of claim 1, wherein a high risk order is 
evaluated with more resources than a medium risk order. 

20 

4. The method of claim 1, wherein a low risk order is 
evaluated with less resource than a high risk order and 
medium risk order. 
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5. The method of claim 1, wherein a low risk order is 
evaluated with less time than a high risk order and medium 
risk order. 

6. The method of claim 1, wherein an indicator of 
possible high risk activities include at least one of: 

an order amount over a high risk amount threshold; 
a shipping address for the order to a particular high 
risk region; 

a non-domestic Internet Protocol address of the 
customer; 

a card verification number authorization code having a 
value from a first group of code values; 

an address verification code indicating a foreign 
credit card by the customer; and ' 

an order quantity over a high risk quantity threshold. 

7. The method of claim 1, wherein an indicator of 
possible high risk activities further includes: 

an eFalcon score within a first range of values. 

8. The method of claim 1, wherein an indicator of 
possible medium risk activities include at least one of: 

an order amount over a medium risk amount threshold; 
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an order for a particular designated product; 
a card verification number authorization code having a 
value from a second group of code values; 

an address verification code indicating a particular 
5 value from a group of CVN code values; 

a billing address differing from a shipping address; 
a shipping address to a medium risk region; and 
an order quantity over a medium risk quantity 
threshold. 

10 

9. The method of claim 1, wherein an indicator of 
possible medium risk activities further includes: 

an eFalcon score within a second range of values. 

15 10. The method of claim 1, wherein the order is received 
in a website. 

11. The method of claim 1, wherein the order is received 
in a call center. 

20 

12. The method of claim 1, wherein the order is an order 
for a product. 

13. The method of claim 1, wherein the order is an order 
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for a service. 

14. An apparatus of determining a risk for fraud for an 
order, the method comprising: 

5 means for receiving an order from a customers- 

means for evaluating an order based upon indicators of 
possible high risk activities, wherein if the order is not 
classified as a high risk order, then evaluating the order 
based upon indicators of possible medium risk activities; 

10 and wherein if the order is not a medium risk activity, 
then classifying the order as a low risk order. 

15. An article of manufacture, comprising: 

a machine -readable medium having stored thereon 
15 instructions to: 

receive an order from a customer; 

evaluate an order based upon indicators of possible 
high risk activities, wherein if the order is not 
classified as a high risk order, then evaluate the order 
20 based upon indicators of possible medium risk activities; 
and wherein if the order is not a medium risk activity, 
then classify the order as a low risk order. 
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16. A method of dynamically adjusting indicators for 
detecting fraud based upon observed trends in fraud 
activities, the method comprising: 

analyzing observed trends in fraud activities; 
5 dynamically adjusting indicators of high risk related 

to fraud, based upon the observed trends; and 

dynamically adjusting indicators of medium risk 
related to fraud, based upon the observed trends. 

10 17. The method of claim 16, wherein an indicator of high 
risk related to fraud include at least one of: 

an order amount over a high risk amount threshold; 

a shipping address for the order to a particular high 
risk region; 

15 a non-domestic Internet Protocol address of the 

customer; 

a card verification number authorization code having a 
value from a first group of code values; 

an address verification code indicating a foreign 
20 credit card by the customer; and 

an order quantity over a high risk quantity threshold. 

18. The method of claim 16, wherein an indicator of high 
risk related to fraud further includes: 
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an eFalcon score within a first range of values. 

19. The method of claim 16, wherein an indicator of medium 
risk related to fraud include at least one of: 

5 an order amount over a medium risk amount threshold; 

an order for a particular designated product; 

a card verification number authorization code having a 
value from a second group of code values; 

an address verification code indicating a particular 
10 value from a group of CVN code values; 

a billing address differing from a shipping address; 

a shipping address to a medium risk region; and 

an order quantity over a medium risk quantity 
threshold. 

15 

20. The method of claim 16, wherein an indicator of medium 
risk related to fraud further includes: 

an eFalcon score within a second range of values. 

20 21. An apparatus for determining a risk for fraud for an 
order, the apparatus comprising: 

a server configured to permit an analyst to evaluate 
an order based upon indicators of possible high risk 
activities; 
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wherein if the order is not classified as a high risk 
order, then the order is evaluated based upon indicators of 
possible medium risk activities; and 

wherein if the order is not classified as a medium 
5 risk activity, then the order is classified as a low risk 
order. 

22. The apparatus of claim 21, wherein a high risk order 
is evaluated with more time than a medium risk order. 

10 

23. The apparatus of claim 21, wherein a high risk order 
is evaluated with more resources than a medium risk order. 

24. The apparatus of claim 21, wherein a low risk order is 
15 evaluated with less resource than a high risk order and 

medium risk order. 

25. The apparatus of claim 21, wherein a low risk order is 
evaluated with less time than a high risk order and medium 

20 risk order. 

26. The apparatus of claim 21, wherein an indicator of 
possible high risk activities include at least one of: 

an order amount over a high risk amount thresholds- 
SB 
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a shipping address for the order to a particular high 
risk region; 

a non-domestic Internet Protocol address of the 
customer; 

5 a card verification number authorization code having a 

value from a first group of code values; 

an address verification code indicating a foreign 
credit card by the customer; and 

an order quantity over a high risk quantity threshold. 

0 

27. The apparatus of claim 21, wherein an indicator of 
possible high risk activities further includes: 

an eFalcon score within a first range of values. 



15 28. The apparatus of claim 21, wherein an indicator of 
possible medium risk activities include at least one of: 

an order amount over a medium risk amount threshold; 

an order for a particular designated product; 

a card verification number authorization code having a 
20 value from a second group of code values; 

an address verification code indicating a particular 
value from a group of CVN code values; 

a billing address differing from a shipping address; 

a shipping address to a medium risk region; and 
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an order quantity over a medium risk quantity 
threshold. 

29. The apparatus of claim 21, wherein an indicator of 
5 possible medium risk activities further includes: 

an eFalcon score within a second range of values. 

30. The apparatus of claim 21, wherein the order is 
received in a website. 

10 

31. The apparatus of claim 21, wherein the order is 
received in a call center. 

32. The apparatus of claim 21, wherein the order is an 
15 order for a product. 

33. The apparatus of claim 21, wherein the order is an 
order for a service . 
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